Examkin

Question

Difficulty: HardIntrusion Detection and Prevention Systems (IDS/IPS)

An enterprise organization is updating its security architecture to protect internal application servers. The solution must achieve two primary objectives: first, detect zero-day exploit attempts against server kernel processes that receive encrypted transport payloads; second, monitor network-wide bandwidth and protocol utilization patterns without introducing packet delivery latency or creating a single point of failure on the network link. Which of the following deployment choices will meet these requirements? (Select TWO.)

  1. Deploy Host-based Intrusion Prevention Systems (HIPS) using anomaly-based detection on the application servers.Answer
  2. B
    Deploy Network-based Intrusion Prevention Systems (NIPS) connected out-of-band to switch SPAN ports to drop malicious packets.
  3. Deploy a Network-based Intrusion Detection System (NIDS) connected out-of-band via a hardware network TAP.Answer
  4. D
    Deploy an inline Network-based Intrusion Detection System (NIDS) configured with signature-based decryption at Layer 2.

Answer

The organization should deploy Host-based Intrusion Prevention Systems (HIPS) with anomaly-based detection on the application servers and deploy a Network-based Intrusion Detection System (NIDS) connected out-of-band via a hardware network TAP.
Deploying HIPS with anomaly detection directly on the servers allows inspection of unencrypted host operations and system calls, permitting active blockage of novel zero-day exploits. Deploying NIDS out-of-band via a hardware TAP delivers full network visibility for monitoring traffic trends without placing any processing delay on the inline path.

Step-by-Step Solution

1
Analyze the host security requirement for encrypted payloads and zero-day threat prevention.
Network-based devices cannot inspect encrypted payloads without TLS termination, whereas host-based systems (HIPS) inspect data after decryption. Anomaly-based detection is required because signature-based detection cannot identify zero-day attacks.
Host-based prevention operates at the system call/process level, allowing it to actively block behavior anomalies on the server itself.
2
Analyze the network monitoring requirement for zero latency and high availability.
Inline deployments (such as NIPS) introduce processing delay and risk becoming a single point of failure. Out-of-band deployments using hardware TAPs or SPAN ports eliminate latency.
NIDS connected to a hardware TAP passively analyzes copied traffic without impacting inline link latency or network availability.

Key Concept

HIDS/HIPS vs NIDS/NIPS Placement and Detection Logic
Rate this question

Topics

Intrusion Detection and Prevention Systems (IDS/IPS)

More questions from this topic